Used under creative commons from brittgow Flickr

“We’re LulzSec, a small team of lulzy individuals who feel the drabness of the cyber community is a burden on what matters: fun. Considering fun is now restricted to Friday, where we look forward to the weekend, weekend, we have now taken it upon ourselves to spread fun, fun, fun, throughout the entire calendar year“.

 
Of course similar groups have emerged around the world in places as far flung as Pakistan and India, where there is fierce competition between the groups. In Romania groups such as HackersBlog have hit various companies. In China and Russia, many hackers are believed to act as proxies for their governments.
 
It’s not all about the hacking for fun and kudos gangs, organised criminal groups have been with us for many years now, and the last 12 months or so has seen a marked increase in the frequency of attacks on online aggregations of information, such as Sony, Epsilon or Citibank for the purposes of theft of information for financial reward. One single attack, if successful can yield such a vast amount of saleable or otherwise abusable personal data, that I’m only surprised the attacks took so long to gather pace.
 
Another phenomenon that has risen to prominence recently is purported nation-state activity. Again, despite recent press coverage this is also nothing new, the Titan Rain attacks for example date back to 2003 where the finger was firmly pointed at China for the theft of large amounts of information from military and governmental targets, gh0stnet in 2007 was similarly blamed on China, as were the Aurora attacks the following year. This year has already seen similarly motivated attacks on RSA, the European Council, the French Finance Ministry, the Canadian government, Lockheed Martin and of course Stuxnet.
 
So many technological and cryptographically advances have their roots in the centuries old art of espionage, we should really not be surprised to see national foreign intelligence services making use of cutting edge tools and techniques to further their national or economic interests.
 
None of this represents a global online meltdown, or the end of the internet economy or national security as we know it. Like everything else in this world we can trace a simple process of evolution at work here. Security companies, individuals and enterprises must evolve to keep pace and just maybe learn some of the lessons that some of these guys have been teaching us for years now. Encrypt your data, develop securely, configure correctly, test your defences effectively, use complex passwords, shield your vulnerabilities and build your systems under the assumption that a breach *will* happen.
 

In an echo of the move by governments including India, Saudi Arabia and the United Arab Emirates to ban the use of certain encrypted Blackberry services last year, the Russian Federal Security Service have cited Skype, Gmail and Hotmail as a “threat to national security” and has suggested a ban.

According to a release from ITAR-TASS, head of the FSB Information and Special Communication Centre, Alexander Andreyechkin stated:

“Uncontrollable use of such services can create a major threat to Russia’s security“

Andreyechkin reportedly went on to argue that, because the servers and encryption technology used all reside outside Russia it creates difficulty in carrying out investigations, asserting that these services are often used by “foreign extremists”.

The remarks, made before a government Communication & Technology committee meeting, which subsequently continued without press presence, appear to have cause a certain amount of confusion in the Kremlin. Dimitry Peskov, press secretary to Vladimir Putin confirmed that this opinion represented the official position of the FSB, saying “FSB representatives don’t express personal points of view. Naturally, that was the position of the agency“. Whereas Russian Communications minister Igor Shchegolev stated “We have no plans to cancel or close Skype, gmail, hotmail or any other foreign internet services in Russia“, adding perhaps a little more worryingly, “We are now discussing how to regulate such technologies, including economically.“

The main cause of concern for the FSB seems to be in the encryption employed by these services and the aim appears to be either to deny access to services such as these, or to use the threat of such a ban in order to open negotiations to improve the access of Russian security services to encrypted information. The countries that threatened a ban on Blackberry use reached an agreement with RIM, the Blackberry manufacturer, that allowed usage to continue uninterrupted, details of this compromise have never been revealed.

Vladimir Putin is currently heading a committee, set up by the Communication & Technology commission, charged with setting out a plan to regulate the mass use of internet encryption technology within Russia. The committee is due to report on October the 1st of this year. Watch this space…

My notification mail from Hilton HHonors

• Pay careful attention to emails your receive in the coming months, perhaps years.
• Never surrender personal information to a website without having used one of your own bookmarks to get there or typing it yourself (i.e. don’t follow links in mails).
• Before giving out personal details, ensure that the connection is secured with SSL. You can see this is the case if the address starts with “https://“. If it’s not encrypted they don’t deserve your data.
• Read the privacy agreement carefully before you hand over any details. If there is anything you are unhappy with reconsider your decision to sign up.
• To better insure yourself against this kind of eventuality in future consider using unique addresses for each service, I wrote an article on how to easily achieve this here.

 
And for all of the companies out there that process, store or transmit personal data belonging to other people… ENCRYPT IT, no excuses, no get out clause. This is only the beginning and you owe your customers a duty of care.
 

used under creative commons from rieh's Flickr

“Our website has been the victim of hackers. 24 hour security monitoring has shown us that we are still being targeted and there are continuing attempts to re-enter. We refuse to put our customers at risk of another entry – so have decided to completely retire this version of our website. For complete ease of mind, we would like all customers that placed ONLINE orders with us between 4th Oct 2010 and today, 20th Jan 2011, to contact their banks for advice as their card details may have been compromised.”

 
I was initially alerted to the attack by one of my own friends whose card, along with her husband’s have subsequently been used to make fraudulent purchases totalling almost ÂŁ6000 from well-known online retailers.
 
The risk of these stolen card numbers being used by criminals has already moved from the theoretical to reality.
 
For the most part shopping online is as safe as shopping in store, but when a compromise occurs at an online merchant often its consequences are far greater, affecting many more people than in store card cloning due to the centralised nature of online stores. If you feel you may have been affected, contact your bank immediately.
 
Consumers should be demanding more services such as one-time credit card numbers from their financial institutions to afford them more protection when shopping online. One-time credit card numbers were introduced back in 2000 by AmEx but have not been as widely adopted by consumers as I would have expected. Talk to your bank, find out what security they offer for online shopping.
 
Lush haven’t gone public over exactly how the information was accessed, but it’s never a bad idea to restate a few best practices for securing web applications:
 

• Keep them patched.
• NEVER store sensitive data in clear text (in fact this is a PCI requirement).
• Get them regularly vulnerability scanned from the inside as well as the outside.
• Use strong authentication (2 factor) if you are only serving a limited user population or if the data you are holding is particularly sensitive. Cookies can lead to session hijacking.
• Bounds checking of input data helps to avoid buffer overflows and SQL injection type attacks.
• Provide access to information on a Need to Know basis and always provide it with Least Privilege.
• Don’t provide detailed error information to browsers, you don’t expect your customers to debug your application, so don’t give up that error message.

A report released this month by the
European Network and Information Security Agency (ENISA) has investigated the utility and applicability of cloud services for governments across Europe.

The report, entitled “Security and Resilience in Governmental Clouds” aims to provide a decision making model that can be used by governments and other public bodies, to assess the information security challenges posed by cloud computing and to guide them in the definition of their requirements when planning such a migration.
 
All in all it is a thorough piece of work and should absolutely be on the recommended reading for anyone; private enterprises included, considering the commercial benefits of cloud.
 
One conclusion of the report though did seem at best premature, if not a little under researched. The report recommends:

“its [public cloud] adoption should be limited to non-sensitive or non critical applications and in the context of a defined strategy for cloud adoption which should include a clear exit strategy.”

 
On the face of it this is sensible advice but unfortunately the report does not go on to address the strategies and technologies that exist to mitigate these risks, making public cloud a viable and secure platform for enterprises and public bodies alike.
 
Some of the risks identified in the report are: improper access to confidential data (either at the service provider or by intrusion), service provider lock-in due to proprietary technologies, lack of audit and monitoring capabilities, concerns over application and OS patching strategies and access to encryption keys among others. Unfortunately the recommendations while sound do not offer any concrete detail on architectural strategies that overcome these issues even though this is already a technical possibility, at least in the Infrastructure as a Service model.
 
The multi-tenanted nature of public cloud means that organisations need to be able to reduce their effective perimeter to the edge of their virtual machine, effectively segmenting their systems away from other customers. The service provider’s network should be treated as public. In the IaaS environment the customer retains ownership of and responsibility for the patch levels of their virtual machines, host level firewalling and vulnerability shielding offer the opportunity to neutralise the threat of exploitation of vulnerability, even in the absence of a patch. Log and file integrity monitoring offer a means of audit and control and in the IaaS environment are simple to implement at host level.
 
The challenge of data security in public clouds has typically been more complex to answer, as encryption services are usually managed by the cloud provider. Organisations need the ability to segment their data away from other customers but also away from the service provider. Service providers need that too, otherwise they risk inheriting some serious liability. Data should be provisioned to the cloud in an encrypted format, the data owner should retain ownership and control of the keys and only the customer’s own machines should be able to get access to those keys ensuring that the data is only ever in-the-clear inside the secure perimeter of their own virtual machines.
 
Properly architected data encryption that operates transparently and is engineered for the cloud, encryption that is managed by the customer and not the service provider is a business enabler. It accelerates adoption of cloud services, drives down costs, and allows regulatory and legislative compliance. It means you no longer have to worry about how you’re going to delete the cloud when you decide to change service provider.

from zappowbang's photostream under creative commons

Data breach laws are starting to become a serious concern for businesses of all shapes and sizes. It’s already five years since California passed data breach disclosure laws, requiring companies to notify customers of security lapses. Since then almost all other US states have joined it, many opting for penalties that could potentially land companies with a likely loss of reputation and crippling fines if customer data is lost or stolen.

Ireland published proposed measures on the subject two weeks ago. Frankly, it’s only a matter of time before the UK follows suit either through its own legislation or that of the EU.
 
Over on the Register, we’ve been running a series of articles about what constitutes an appropriate level of security, with the impending arrival of data breach laws adding some urgency to the discussion.
 
A common reaction is to demand the encryption of backup files. This appeals to companies not only because it makes it a lot less likely that any lost information can be used – you could even argue that encrypted data doesn’t even count as ‘information’ at all, following the line that information is data you can act upon. But also, it’s especially appealing to companies because encrypted data is exempt from the disclosure requirements in many forms of this legislation. So the potential loss of reputation and customer trust is hopefully avoided.
 
Encryption is trickier than it looks, though. First of all, what kind of encryption are you going to use? Software encryption takes time – and for larger organisations, it’s possible that the rate of data production – the proliferation of stuff you’re supposed to be backing up – could quickly exceed the rate at which data can be encrypted. Hardware encryption of backups often looks more attractive as a result, but being tied to a particular vendor with no rescue plan for when they go under is a recipe for spectacular disaster. There’s some interesting advice on this topic in this post from Securosis.
 
Backup hardware on its own is already proving hard to manage when it comes to finding data from more than a couple of years ago. Have you still got a tape streamer that will fit the open-reel tapes and cartridges from the early noughties? Still got a computer with a SCSI card to fit the streamer onto? Still got the cable to put the two together? I’m sure sysadmins will be delighted when they’re told to add encryption to the mix.
 
Now let’s throw in key management. Exactly how secure does your encryption need to be? And how secure will today’s tapes need to be in five years, a not uncommon legal retention requirement. Who will have access to encryption keys and how will they, in turn, be secured? Once again, this needs a systematic approach. There needs to be a plan and a backup plan for when it all goes wrong. Needless to say, there are products that can help with this – but as always, they can only do so much if the strategy for their implementation and management is weak.
 
Anyway, El Reg is conducting a poll to detect current attitudes towards encrypting data. We’ll be really interested to see the results, so make sure you add your own voice over there – and let me know what you think here in the comments box, too.

A flaw that allows an unauthorised backup to be made? Shurely shome mishtake...

Bernd Marienfeldt has discovered that by booting a PIN protected iPhone, while it is connected to the USB port of an Ubuntu system, he could access

“music, photos, videos, podcasts, voice recordings, Google safe browsing database, game contents
 by in my opinion the quickest compromising read/write access discovered so far, without leaving any track record by the attacker.”

 
This access was through the Ubuntu interface and did not require any PIN at all, furthermore the access was not simply read-only, but read/write.
 

Even on a standard Windows Vista, it's PIN not required